Patent literature 1 describes an example of an operation management system which generates a model of a system by using time-series information of system performance and detects a failure of the system by using the generated model.
The operation management system described in Patent literature 1 determines a correlation for each combination among a plurality of metrics on the basis of measurements of the plurality of metrics (performance indexes) in the system, and generates a correlation model including a plurality of correlation functions each indicating the correlation. The operation management system can identify a cause of a failure by a method in which it is determined whether destruction of the correlation (correlation destruction) occurs or not for newly inputted measurements of metrics by using the generated model and a metric on which the correlation destruction is concentrated is detected, for example. The technology for analyzing the cause of a failure on the basis of the correlation destruction is referred to as an invariant analysis.
The invariant analysis focuses on the correlation between metrics instead of largeness of metric values. Therefore, the invariant analysis has advantages such that it does not need to set a threshold value; it can detect failures which cannot be detected by using the threshold value; and a cause of abnormality is identified easily, compared with the case that a failure is detected by comparing each value of the metrics with the threshold value.
As a related technology, Patent literature 2 discloses a technology which detects abnormality of a communication network on the basis of probability distribution of communication quality indexes in a mobile communication network. Patent literature 3 discloses a technology which identifies a cause of a failure using a correlation analysis rule for an event. Patent literature 4 discloses a technology which calculates a degree of certainty of failures in a network and displays the failures in order of the degree of certainty.